Consumer Health Data Privacy Policy

Effective Date: June 10, 2026

This Consumer Health Data Privacy Policy describes how Centered Connections, PLLC (“Centered Connections,” “we,” “us,” or “our”) collects, uses, discloses, and protects consumer health data under Washington’s My Health My Data Act, chapter 19.373 RCW. It applies to consumer health data we collect through our website at centeredconnections.support.

Most health information we maintain about our clients is protected health information governed by the Health Insurance Portability and Accountability Act (HIPAA) and described in our Notice of Privacy Practices. That information is not covered by this policy. This policy covers consumer health data that is not protected health information under HIPAA, such as information collected when you contact us through our website before you become a client.

We collect a limited amount of consumer health data through our website:

• Information that identifies you as seeking health care services. When you contact us through our website about a psychological assessment, group therapy, or a related service, your inquiry and the details you provide may indicate that you are seeking mental health services.
• Contact information you provide in that context, such as your name, email address, and phone number.
• Technical information associated with your visit, such as your IP address, which our hosting and security providers process when you view pages about our services.

We do not collect precise location information through our website, and we do not use geofencing.

We collect consumer health data directly from you when you complete our contact form or otherwise contact us through the website. We also collect technical information automatically through our website hosting and security providers when you visit the site.

We use consumer health data to respond to your inquiry, to communicate with you about scheduling and services, to provide the services you request, and to operate and secure our website. We do not use consumer health data for advertising, and we do not use it to target advertising to you.

We do not sell consumer health data, and we do not share consumer health data with any third party or affiliate. We disclose consumer health data only to processors that handle it on our behalf, under contract, to help us operate the website and communicate securely with you. These processors are:

• Paubox, which secures the email generated by our contact form.
• Cloudflare, which provides website content delivery, security, and protection of our contact form from spam and abuse through Cloudflare Turnstile.
• Wordfence, which provides website security.
• Bluehost, which hosts our website.

We do not disclose consumer health data to affiliates for their own purposes, and we do not provide consumer health data to any third party for advertising.

We collect consumer health data only as needed to provide the services you request and to operate and secure our website. If we ever intend to collect, use, share, or disclose consumer health data for a purpose not described in this policy, we will first obtain your consent. We do not sell consumer health data, and we will obtain your separate written authorization before any sale.

Under the My Health My Data Act, you have the right to:

• confirm whether we are collecting, sharing, or selling your consumer health data, and access that data, including a list of all third parties and affiliates with whom we have shared or sold your consumer health data and a way to contact them. Because we do not share or sell consumer health data with third parties or affiliates, that list will be empty;
• withdraw your consent to our collection and sharing of your consumer health data; and
• request that we delete your consumer health data.

To exercise these rights, contact us using the information below. There is no charge to make a request. We will respond within 45 days. When reasonably necessary, we may extend that period once by an additional 45 days, and we will notify you of the extension, and the reason for it, within the initial 45 day period. We will take steps to verify your identity before acting on your request, and you do not need to create an account with us to make a request. If we cannot verify your identity, we may ask for additional information or decline the request.

If we decline to act on your request, you may appeal our decision by contacting us using the information below and stating that you are submitting an appeal. Within 45 days of receiving your appeal, we will inform you in writing of any action taken or not taken in response, including an explanation of our reasons. If we deny your appeal, we will provide you with information you may use to contact the Washington Attorney General to submit a complaint.

We restrict access to consumer health data to the people and processors who need it to provide the services you request or to operate and secure our website. We maintain reasonable administrative, technical, and physical safeguards to protect consumer health data, including encrypted email through Paubox and security protection through Cloudflare and Wordfence.

We do not use a geofence around any health care facility, and we do not use geofencing to identify or track consumers, to collect consumer health data, or to send messages or advertising to consumers based on their proximity to a health care facility.

We may update this policy. Before we collect or disclose categories of consumer health data, or use consumer health data for purposes, that are not described in this policy, we will update the policy and obtain your consent where the law requires it.

Centered Connections, PLLC

22717 SE 29th Street, Suite D-101, Sammamish, WA 98075

(425) 600-2235

www.centeredconnections.support

Effective Date: June 10, 2026